What is GHSA-4m2g-668v-jwjx?

GHSA-4m2g-668v-jwjx is a security advisory published by GitHub Security Advisories with Medium severity. Cross site scripting in getkirby/starterkit

Which CVE IDs does GHSA-4m2g-668v-jwjx cover?

GHSA-4m2g-668v-jwjx covers the following CVE IDs: CVE-2022-35174. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4m2g-668v-jwjx?

GHSA-4m2g-668v-jwjx has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-4m2g-668v-jwjx?

GHSA-4m2g-668v-jwjx affects 1 product, including: composer/getkirby/starterkit:\u003c= 3.7.0.2.

GHSA-4m2g-668v-jwjxMediumCVSS 5.4

Cross site scripting in getkirby/starterkit

Vendor

GitHub Security Advisories

Published

August 19, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-35174 →

📋 Description

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.

🎯 Affected products1

composer/getkirby/starterkit:<= 3.7.0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-35174
https://owasp.org/www-community/attacks/xss/
https://www.youtube.com/watch?v=0lngc_zPTSg
https://github.com/advisories/GHSA-4m2g-668v-jwjx